ci: pin the conformance catalog by SHA instead of cloning its default branch #24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| # Least-privilege default; this workflow only reads the repo. | |
| permissions: | |
| contents: read | |
| jobs: | |
| quality: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # JDK matrix is a list so we can expand as new LTS releases land. | |
| # Current floor: 21 — set by pom.xml's <java.version>21</java.version>. | |
| java-version: ["21"] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # Uses the runner's built-in git instead of actions/checkout: equivalent | |
| # trust for a public repo (AuthPlane/conformance), no third-party action | |
| # surface to SHA-pin. Keeps the catalog outside the workspace so | |
| # release.yml's `git add -A` cannot stage it as an embedded gitlink. | |
| - name: Check out shared conformance catalog (outside workspace) | |
| # Conformance catalog pinned by SHA (was: clone of the latest default | |
| # branch). The single source of truth for the ref is the tracked | |
| # `.conformance-catalog-ref` file at the repo root — bump it when | |
| # adopting new catalog cases, together with the SDK-side conformance | |
| # coverage, so a catalog change can never break CI on its own. The | |
| # Checkout step above must precede this read. Source: | |
| # github.com/AuthPlane/conformance. | |
| run: | | |
| CONFORMANCE_CATALOG_REF="$(cat "$GITHUB_WORKSPACE/.conformance-catalog-ref")" | |
| # Guard the pin: a non-SHA value would silently un-pin CI to whatever | |
| # ref resolves at fetch time. | |
| grep -Eq '^[0-9a-f]{40}$' <<<"$CONFORMANCE_CATALOG_REF" \ | |
| || { echo "::error::.conformance-catalog-ref must be a 40-hex commit SHA"; exit 1; } | |
| git init -q "${{ runner.temp }}/conformance" | |
| git -C "${{ runner.temp }}/conformance" \ | |
| fetch --depth=1 https://github.com/AuthPlane/conformance.git "$CONFORMANCE_CATALOG_REF" \ | |
| || { echo "::error::Pinned conformance catalog ref $CONFORMANCE_CATALOG_REF is unreachable"; exit 1; } | |
| git -C "${{ runner.temp }}/conformance" checkout -q FETCH_HEAD | |
| - name: Setup Java | |
| uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0 | |
| with: | |
| distribution: temurin | |
| java-version: ${{ matrix.java-version }} | |
| cache: maven | |
| - name: Verify and validate publish artifacts | |
| # Single reactor pass covering all three modules (core, mcp, spring). | |
| # - verify: compile + run unit tests + conformance tests + package | |
| # + run bound plugins (checkstyle, jacoco, etc.) | |
| # - source:jar / javadoc:jar: confirms the artifacts that will be | |
| # published to Maven Central can be built. | |
| # Must be one mvn invocation: `source:jar` / `javadoc:jar` are run | |
| # directly (no phase), so splitting them off would leave the second | |
| # invocation unable to resolve inter-module deps from ~/.m2 (we | |
| # don't install). | |
| # | |
| # CONFORMANCE_CATALOG_PATH points at the catalog checked out in the | |
| # previous step. This is the explicit override ConformanceCatalogPaths | |
| # checks first, avoiding any path-resolution ambiguity. | |
| env: | |
| CONFORMANCE_CATALOG_PATH: ${{ runner.temp }}/conformance/oauth-sdk-conformance-catalog.yaml | |
| run: mvn -B verify source:jar javadoc:jar |